Canada Revenue agency phish from Barracuda/Amazon
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 27 Jul 2026 09:24:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1woNBI-00000000BLX-1NqA
for dave@doctor.nl2k.ab.ca;
Mon, 27 Jul 2026 09:23:52 -0600
Resent-From: The Doctor
Resent-Date: Mon, 27 Jul 2026 09:23:52 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from egress-ip21a.ess.ca.barracuda.com ([15.222.16.189]:39362)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1woMlG-000000008dM-1QXg
for sales@nk.ca;
Mon, 27 Jul 2026 08:57:07 -0600
Received: from yk-prod-fe3.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound12-30.ca-central-1a.ess.aws.cudaops.com; Mon, 27 Jul 2026 14:56:04 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;
d=northwestel.net;
h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;
bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;
b=h0phmPd9taXVj59Lqi0UrmhFFQgPnpEXPekxegb7imUR1hhgMOQSVh2BocoWqfiRg5kcu/a/At6A
SUSIUG79y/umA7nzP60JWzSTfRzbAgcIGsitP34x+xb1JlB5NNBVS+wCz+MzvnwLKoUfUfsTpw+Q
5pdI7SYAmtmsp5+jHbQk522FuCnASvA/l7KOeXNTesWsFsnQmgfKjwmD23Matsk2OHrzduDoOERY
Au8LGdE9A1nqh6qmLX782qJ2EPdfQTkaPPKs0pxAAeTFWNyrAEGuHCzi0SFDnV1mehEOa5+AZ2AR
O8SL+lA9Kv2vYldL7Z8njJHpuK2xa6M89NlEuw==
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/html
Received: from dkim-sign.northwestel.ca-daemon by
yk-prod-fe3.internal.messaging
(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16
2025)) id <0TIM22E00BWU9Y00@yk-prod-fe3.internal.messaging> for sales@nk.ca;
Thu, 23 Jul 2026 02:08:01 -0600 (MDT)
Received: from [14.192.212.27] ([172.19.112.111])
by yk-prod-fe3.internal.messaging
(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16
2025)) with ESMTPA id <0TIM21SD2BXAX670@yk-prod-fe3.internal.messaging> for
sales@nk.ca; Thu, 23 Jul 2026 02:08:01 -0600 (MDT)
From:
"Canada Revenue Agency / Agence du Revenu du Canada"
To: sales@nk.ca
Subject:
=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=
Date: 23 Jul 2026 03:07:57 -0500
Message-id: <20260723030757.1A8EEF88BA4A2D26@northwestel.net>
X-BESS-ID: 1785164164-403102-29209-651794-1
X-BESS-VER: 2019.1_20260723.2316
X-BESS-Apparent-Source-IP: 199.85.226.114
X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU
lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==
X-BESS-Outbound-Spam-Score: 1.00
X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274951 [from
cloudscan11-130.ca-central-1a.ess.aws.cudaops.com]
Rule breakdown below
pts rule name description
---- ---------------------- --------------------------------
0.00 HTML_MESSAGE BODY: HTML included in message
0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.00 BSF_BESS_OUTBOUND META: BESS Outbound
0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c
0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963
X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, MIME_HTML_ONLY, BSF_BESS_OUTBOUND, BSF_SC7_PS0024c, BSF_SC5_MJ1963
X-BESS-BRTS-Status:1